cirrus: fix blit region check

Issues:
 * Doesn't check pitches correctly in case it is negative.
 * Doesn't check width at all.

Turn macro into functions while being at it, also factor out the check
for one region which we then can simply call twice for src + dst.

This is CVE-2014-8106.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
cirrus: don't overflow CirrusVGAState->cirrus_bltbuf

This is CVE-2014-8106.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging

cirrus: fix blit region check

# gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-cve-2014-8106-20141204-1:
  cirrus: don't overflow CirrusVGAState->cirrus_bltbuf
  cirrus: fix blit region check

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Update version for v2.2.0-rc5 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Update version for v2.2.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Open 2.3 development tree

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
stm32f2xx_timer: Add the stm32f2xx Timer

This patch adds the stm32f2xx timers: TIM2, TIM3, TIM4 and TIM5
to QEMU.

---CHANGELOG---
PUBLIC
V6:
 - Rename to STM32F2XX
 - Change the timer calculations to use ns
 - Update the value to timer_mod to ensure it is in ns
 - Account for reloadable/resetable timer
    - Thanks to Peter C for pointing this out
V4:
 - Update timer units again
    - Thanks to Peter C
V3:
 - Update debug statements
 - Correct the units for timer_mod
 - Correctly set timer_offset from resets
V2:
 - Reorder the Makefile config
 - Fix up the debug printing
 - Correct the timer event trigger
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
stm32f2xx_USART: Add the stm32f2xx USART Controller

This patch adds the stm32f2xx USART controller
(UART also uses the same controller).

---CHANGELOG---
PUBLIC
V6:
 - Rename to STM32F2XX
 - Fix up unimplemented printing
 - Add a qemu_chr_accept()
V3:
 - Update debug printing
V2:
 - Drop charecters if the device is not enabled
    - Thanks to Peter C
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG

This patch adds the stm32f2xx System Configuration
Controller. This is used to configure what memory is mapped
at address 0 (although that is not supported) as well
as configure how the EXTI interrupts work (also not
supported at the moment).

This device is not required for basic examples, but more
complex systems will require it (as well as the EXTI device)

---CHANGELOG---
PUBLIC
V6:
 - Rename to STM32F2XX
 - Remove all casts from debug printing
V5:
 - Correct the masks used for writing
V3:
 - Update debug printing
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
target_arm: Remove memory region init from armv7m_init

This patch moves the memory region init code from the
armv7m_init function to the stellaris_init function

---CHANGELOG---
PUBLIC
V3:
 - Rename the flash_size argument to mem_size
 - Remove the sram_size and related code
    - Thanks to Peter C
V2:
 - Change the memory region names to match the machine
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
target_arm: Parameterise the irq lines for armv7m_init

This patch allows the board to specifiy the number of NVIC interrupt
lines when using armv7m_init.

---CHANGELOG---
PUBLIC
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
stm32f205: Add the stm32f205 SoC

This patch adds the stm32f205 SoC. This will be used by the
Netduino 2 to create a machine.

---CHANGELOG---
PUBLIC
V6:
 - Correct the number of USART/UART devices
 - Use macros to define how many devices are inited
 - Update the memory regions name from netduino.* to
   STM32F205.*
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
netduino2: Add the Netduino 2 Machine

This patch adds the Netduino 2 Machine.

This is a Cortex-M3 based machine. Information can be found at:
http://www.netduino.com/netduino2/specs.htm

---CHANGELOG---
PUBLIC
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>
COVER: Netduino 2 Machine Model

---CHANGELOG---
PUBLIC
This patch series adds the Netduino 2 Machine to QEMU

Information on the board is avalible at:
http://www.netduino.com/netduino2/specs.htm

The git tree can be found at:
https://github.com/alistair23/qemu/tree/netduino2.6

This patch series makes some changes to the armv7m_init function
that allows the code to be reused with the Netduino 2 and the
Stellaris machines.

Some example code that runs on QEMU is avaliable at:
at: https://github.com/alistair23/CSSE3010-QEMU-Examples

There are more devices in the works, I figured I would just start
with these three

V6:
 - Rename the three devices to STM32FXX*
 - Correct the timer to use ns
 - Correct the number of devices that are inited
 - Rename memory regions
V5:
 - Remove the reset changes based on the ELF entry
V4:
 - Rebase
 - Correct timer units
V3:
 - Correct the timer interrupts
 - Update debug printing
 - Remove the sram_size argument from armv7m_init
---END---

Signed-off-by: Alistair Francis <alistair23@gmail.com>